Harvesting maps from the stub cache for megamorphic ICs is both slow
(linear in the size of the stub cache) and imprecise (as it finds all
maps that have a cached handler for the given property name).
In the canonical megamorphic situation, this type feedback is useless
anyway. The interesting case is when we can filter it down to a single
map; however in these cases it is often possible to derive this map
just by looking at the HGraph, which is both faster and more reliable.

Review URL: https://codereview.chromium.org/1669213003

Cr-Commit-Position: refs/heads/master@{#33998}

Now the tool produces a far more readable output format, which bears a
lot of resemblance to YAML. In fact, the output should be machine
parseable as such, one document per testcase. However, the output format
may be subject to changes in future, so don't rely on this property.

In general, the output format has been optimized for producing a meaningful
textual diff, while keeping a decent readability as well. Therefore, not
everything is as compact as it could be, e.g. for an empty const pool we get:

    constant pool: [
    ]

instead of:

    constant pool: []

Also, trailing commas are always inserted in lists.

Additionally, now the tool accepts its output format as input. When
operating in this mode, all the snippets are extracted, processed and
the output is then emitted as usual. If nothing has changed, the output
should match the input. This is very useful for catching bugs in the
bytecode generation by running a textual diff against a known-good file.

The core (namely bytecode-expectations.cc) has been extracted from the
original cc file, which provides the utility as usual. The definitions
in the matching header of the library have been moved into the
v8::internal::interpreter namespace.

The library exposes a class ExpectationPrinter, with a method
PrintExpectation, which takes a test snippet as input, and writes the
formatted expectation to the supplied stream. One might then use a
std::stringstream to retrieve the results as a string and run it through
a diff utility.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1688383003

Cr-Commit-Position: refs/heads/master@{#33997}

for the special case where the same register is used as both left and
right input.

Review URL: https://codereview.chromium.org/1695283002

Cr-Commit-Position: refs/heads/master@{#33996}

By not calling ReloadPropertyInformation, we avoid expensive descriptor array lookup.

BUG=

Review URL: https://codereview.chromium.org/1697153002

Cr-Commit-Position: refs/heads/master@{#33995}

This is effectively a port of 4eff883b (r27731).

BUG=

Review URL: https://codereview.chromium.org/1692253002

Cr-Commit-Position: refs/heads/master@{#33994}

Passing floating point params to/from C has never quite worked correctly,
but we've never enforced the restriction early in the CallDescriptor
creation process because of unittests. Fix unittests to make their own
simple call descriptors and not rely on the C ones.

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1701593003

Cr-Commit-Position: refs/heads/master@{#33993}

This creates an isolate with the v8-side valgrind wrapper and
the valgrind binaries from third_party. It's dynamically
checked if the directories are present.

Follow up after https://codereview.chromium.org/1585093002/
and https://codereview.chromium.org/1583933006/

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1700673002

Cr-Commit-Position: refs/heads/master@{#33992}

Properly type String.prototype.concat, String.prototype.charCodeAt,
and String.prototype.toLowerCase/toUpperCase in TurboFan. Also assign
better type to %_StringCharFromCode.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1701673002

Cr-Commit-Position: refs/heads/master@{#33991}

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1698063002

Cr-Commit-Position: refs/heads/master@{#33990}

This is to enable deduplicating performance tests. We'll
create a hash of all relevant files and send it to perf bots
alongside the other swarming hashes (follow up on infra
side).

This will not actually run on swarming yet, but could at
some later point.

This splits off the cctest executable from other verification
test files, as those are not needed in performance tests.

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1695243002

Cr-Commit-Position: refs/heads/master@{#33989}

Improve instruction selector for mask and shift operations by using cheaper
instructions where possible, in preference to UBFX.

Reverted because it was suspected of causing a couple of flaky tests to fail,
but investigation suggests this is unlikely.

Original review: https://codereview.chromium.org/1677023002

BUG=

Review URL: https://codereview.chromium.org/1684073006

Cr-Commit-Position: refs/heads/master@{#33988}

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1694183002

Cr-Commit-Position: refs/heads/master@{#33987}

Turn the fast case of ArgumentsAccessStub into a new stub
FastNewSloppyArgumentsStub, which is similar to the existing
FastNewStrictArgumentsStub, although not polished yet, and the slow
case always went to the runtime anyway, so we can just directly emit
a runtime call there.

R=mstarzinger@chromium.org

Committed: https://crrev.com/55b0b4f6d572531eec00ab6ebd8f6feb7c584e04
Cr-Commit-Position: refs/heads/master@{#33973}

Review URL: https://codereview.chromium.org/1695633003

Cr-Commit-Position: refs/heads/master@{#33986}

Fixed frame size is larger when embedded constant pools are enabled.

R=oth@chromium.org, rmcilroy@chromium.org, yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1692973002

Cr-Commit-Position: refs/heads/master@{#33985}

  port 5de27c34(r33865)

  original commit message:
  Calls use registers for target, new_target and argument count.
  We don't always respect argument count. It didn't bite us in the past
  because the code paths where we clobbered it never used it, though
  in future it could be an issue.

BUG=

Review URL: https://codereview.chromium.org/1698823002

Cr-Commit-Position: refs/heads/master@{#33984}

R=jkummerow@chromium.org
BUG=v8:4757
LOG=N

Review URL: https://codereview.chromium.org/1700693002

Cr-Commit-Position: refs/heads/master@{#33983}

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1694643004

Cr-Commit-Position: refs/heads/master@{#33982}

This CL improves running our internal benchmarks locally by adding the
--pretty option to tools/run_perf.py. With the flag enabled we print
the run-time of each benchmark directly and avoid the json output at
the end.

NOTRY=true

Review URL: https://codereview.chromium.org/1681283004

Cr-Commit-Position: refs/heads/master@{#33981}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1695083002

Cr-Commit-Position: refs/heads/master@{#33980}

R=ahaas@chromium.org,aseemgarg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1699793002

Cr-Commit-Position: refs/heads/master@{#33979}

Add a section identifier for declaring a start function as an index into
the function table. (This could also be done as a decl flag on the
function, but don't feel strongly here, since we probably want to redo
this when adding an import/export section.)

The start function must accept no parameters. Its return value is
currently ignored.

R=binji@chromium.org,bradnelson@chromium.org
BUG=chromium:575167
LOG=Y

Review URL: https://codereview.chromium.org/1692173002

Cr-Commit-Position: refs/heads/master@{#33978}

Adds support for ES6 super keyword and performing loads, stores, and
calls to super class members.

Implements SetHomeObject and enables ThisFunctionVariable.

BUG=v8:4280,v8:4682
LOG=N

Review URL: https://codereview.chromium.org/1689573004

Cr-Commit-Position: refs/heads/master@{#33977}

Revert of [runtime] Turn ArgumentAccessStub into FastNewSloppyArgumentsStub. (patchset #2 id:20001 of https://codereview.chromium.org/1695633003/ )

Reason for revert:
[Sheriff] Breaks ASAN with mipsel compile:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20ASAN%20mipsel%20-%20debug%20builder/builds/4558/

Original issue's description:
> [runtime] Turn ArgumentAccessStub into FastNewSloppyArgumentsStub.
>
> Turn the fast case of ArgumentsAccessStub into a new stub
> FastNewSloppyArgumentsStub, which is similar to the existing
> FastNewStrictArgumentsStub, although not polished yet, and the slow
> case always went to the runtime anyway, so we can just directly emit
> a runtime call there.
>
> R=mstarzinger@chromium.org
>
> Committed: https://crrev.com/55b0b4f6d572531eec00ab6ebd8f6feb7c584e04
> Cr-Commit-Position: refs/heads/master@{#33973}

TBR=mstarzinger@chromium.org,jarin@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1701653002

Cr-Commit-Position: refs/heads/master@{#33976}

This is mostly preparation for allowing the function closure to be materialized.

As a drive-by fix, I have added ignition source position support to the frame inspector (this fixed some ignition test failures).

Review URL: https://codereview.chromium.org/1698743002

Cr-Commit-Position: refs/heads/master@{#33975}

Initially we were unable to address certain stack slots in the callee
part of the frame, including the function marker, therefore we had to
hack a reload of the function register into the OSR prologue. Now that
we are able to address all stack slots, we no longer need this hack.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1666073002

Cr-Commit-Position: refs/heads/master@{#33974}

Turn the fast case of ArgumentsAccessStub into a new stub
FastNewSloppyArgumentsStub, which is similar to the existing
FastNewStrictArgumentsStub, although not polished yet, and the slow
case always went to the runtime anyway, so we can just directly emit
a runtime call there.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1695633003

Cr-Commit-Position: refs/heads/master@{#33973}

This adds initial support for inline allocation of object and array
literals to the JSCreateLowering pass. It's basically identical to
what Crankshaft does.

This also unstages the TurboFan escape analysis, as the lowering seems
to trigger a bunch of bugs in it; those bugs will be fixed separately,
and we will re-enable escape analysis afterwards.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1698783002

Cr-Commit-Position: refs/heads/master@{#33972}

  port 3ef573e9(r33809)

  original commit message:
  Replace the somewhat awkward RestParamAccessStub, which would always
  call into the runtime anyway with a proper FastNewRestParameterStub,
  which is basically based on the code that was already there for strict
  arguments object materialization. But for rest parameters we could
  optimize even further (leading to 8-10x improvements for functions with
  rest parameters), by fixing the internal formal parameter count:

  Every SharedFunctionInfo has a formal_parameter_count field, which
  specifies the number of formal parameters, and is used to decide whether
  we need to create an arguments adaptor frame when calling a function
  (i.e. if there's a mismatch between the actual and expected parameters).
  Previously the formal_parameter_count included the rest parameter, which
  was sort of unfortunate, as that meant that calling a function with only
  the non-rest parameters still required an arguments adaptor (plus some
  other oddities). Now with this CL we fix, so that we do no longer
  include the rest parameter in that count. Thereby checking for rest
  parameters is very efficient, as we only need to check whether there is
  an arguments adaptor frame, and if not create an empty array, otherwise
  check whether the arguments adaptor frame has more parameters than
  specified by the formal_parameter_count.

  The FastNewRestParameterStub is written in a way that it can be directly
  used by Ignition as well, and with some tweaks to the TurboFan backends
  and the CodeStubAssembler, we should be able to rewrite it as
  TurboFanCodeStub in the near future.

  Drive-by-fix: Refactor and unify the CreateArgumentsType which was
  different in TurboFan and Ignition; now we have a single enum class
  which is used in both TurboFan and Ignition.

BUG=

Review URL: https://codereview.chromium.org/1696063002

Cr-Commit-Position: refs/heads/master@{#33971}

  port cfbd2561(r33857)

  original commit message:
  Preparing the young generation for (real) non-contiguous backing memory, this
  change removes object masks that are used to compute containment in semi and new
  space. The masks are replaced by lookups for object tags and page headers, where
  possible.

  Details:
  - Use the fast checks (page header lookups) for containment in regular code.
  - Use the slow version that masks out the page start adress and iterates all
    pages of a space for debugging/verification.
  - The slow version works for off-heap/unmapped memory.
  - Encapsulate all checks for the old->new barrier in Heap::RecordWrite().

BUG=

Review URL: https://codereview.chromium.org/1698803002

Cr-Commit-Position: refs/heads/master@{#33970}

  port 2166bd8c (r33797)

  original commit message:

BUG=

Review URL: https://codereview.chromium.org/1697953002

Cr-Commit-Position: refs/heads/master@{#33969}

Rolling v8/build/gyp to 2f9ffdc96135eaa102ee90584e7c6e5e5c45915c

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1701613002

Cr-Commit-Position: refs/heads/master@{#33968}

  port 187b3f28 (r33796)

  original commit message:

BUG=

Review URL: https://codereview.chromium.org/1700583002

Cr-Commit-Position: refs/heads/master@{#33967}

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1691373002

Cr-Commit-Position: refs/heads/master@{#33966}

When we specialize to the native context, we can replace loads of the
NATIVE_CONTEXT_INDEX in any known context with the appropriate native
context for that context. This allows us to constant-fold and further
optimize things like %reflect_construct, which are inserted by the
parser.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1697513003

Cr-Commit-Position: refs/heads/master@{#33965}

Older versions of Emscripten appear to emit Asm.js containing:
HEAP8[x] with x in int
As opposed to the spec legal construct:
HEAP8[x>>0] with x in int

As older programs and even benchmarks such as Embenchen
include these constructs, support them for compatibility.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator,mjsunit/asm-wasm
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1692713006

Cr-Commit-Position: refs/heads/master@{#33964}

Port 09d84535

Original commit message:
    The FastNewStrictArgumentsStub is very similar to the recently added
    FastNewRestParameterStub, it's actually almost a copy of it, except that
    it doesn't have the fast case we have for the empty rest parameter. This
    patch improves strict arguments in TurboFan and fullcodegen by up to 10x
    compared to the previous version.

    Also introduce proper JSSloppyArgumentsObject and JSStrictArgumentsObject
    for the in-object properties instead of having them as constants in the
    Heap class.

    Drive-by-fix: Use this stub and the FastNewRestParameterStub in the
    interpreter to avoid the runtime call overhead for strict arguments
    and rest parameter creation.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1696743002

Cr-Commit-Position: refs/heads/master@{#33963}

Port a2935d63

Original commmit message:
    Saves and restores the dispatch pointer during calls to enable the debugger to
    switch the dispatch table used by a function during it's execution.

    Also moves the accumulator and context nodes to be Variables so that they will
    be properly merged across branches.

R=rmcilroy@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4280,v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1688373002

Cr-Commit-Position: refs/heads/master@{#33962}

This is hopefully the last in a series of cleanup patches around
destructuring assignment. It simplifies the ParseAssignmentExpression
API, making the callers call CheckDestructuringElement() where appropriate.
CheckDestructuringElement has been further simplified to only emit the
errors that the parser depends on it emitting.

I've also beefed up the test coverage in test-parsing.cc to
handling all the destructuring flags being on, which caught an oddity
in how we disallow initializers in spreads in patterns (we need to treat
RewritableAssignmentExpressions as Assignments for the purpose of
error checking).

Finally, I added a few helper methods to ParserBase to handle a few
classes of expressions (assignments and literals-as-patterns).

Review URL: https://codereview.chromium.org/1696603002

Cr-Commit-Position: refs/heads/master@{#33961}

This behavior was changed in https://codereview.chromium.org/1402913002.
It's pretty usefull to have ability to disable debugger statement for our users.

BUG=chromium:583515
LOG=N
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1690173002

Cr-Commit-Position: refs/heads/master@{#33960}

This change expands allocation sampling to include old, map, code, and large object spaces. This involved refactoring much of the observation logic out of NewSpace into Space and overriding as needed in sub-classes.

Additionally, the sampling heap profiler now maintains a pair of heap observers. One observer is used for observing new space and resetting the inline allocation limit to be periodically notified of allocations. The other observes allocation across the other spaces where there is no additional work required to observe allocations.

Tests have been updated to ensure that allocations are observed correctly for Paged and LargeObject spaces.

R=ofrobots@google.com, hpayer@chromium.org, ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1625753002

Cr-Commit-Position: refs/heads/master@{#33959}